Skip to content
Get packs

Deploying Honeytokens and Canarytokens

Plant decoy credentials and files that alert you the moment an intruder touches them

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

Once installed, the agent can help you set up decoy items such as fake AWS keys, fake kubeconfig files, Word or PDF documents, and web links that have no legitimate use. It walks through deploying the open-source Canarytokens service (self-hosted via Docker or the public canarytokens.org site), generates tokens with descriptive labels, and can use a helper script to create tokens and keep a local inventory mapped to MITRE D3FEND and ATT&CK. Any later access to a token sends an alert by email or webhook.

Great for

  • Security teams wanting low-noise intrusion alerts on file shares, password stores, or cloud accounts
  • Developers or sysadmins who own the systems and want to detect credential theft
  • Blue teams building a deception layer as part of a defense-in-depth program

Skip it if

  • Instrumenting systems you do not own or have written authorization to monitor, since this may violate computer-misuse or privacy law
  • Anyone expecting a turnkey product: setup needs Docker, a domain with DNS control, a public IP, and an email or webhook service
  • Production use without review of the helper script, because it runs local Python code and sends requests to external endpoints

Try asking

  • “Create an HTTP canary link and place it on our internal wiki's admin passwords page, alerting soc@example.com”
  • “Set up a self-hosted Canarytokens instance with Docker and walk me through the switchboard and frontend env files”
  • “Generate a decoy AWS credentials token for a Jenkins host and send alerts to our Slack webhook”
  • “Show me the local inventory of deployed tokens and their D3FEND mappings”
Step-by-step guide: how to use Deploying Honeytokens and CanarytokensInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    deploying-honeytokens-and-canarytokens.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deploying-honeytokens-and-canarytokens.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deploying-honeytokens-and-canarytokens.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Use descriptive memos and locations for every token so alerts tell you exactly where the decoy was planted
  • Test each token type end to end to confirm alerts reach your SOC channel before relying on it
  • Keep decoy artifacts out of public repositories and review scripts/agent.py before running it, especially the credentials it handles

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.